Nowadays, the network bears more and more applications, and the requirement of the bandwidth also becomes increasingly higher. The operator hopes to ensure the operation network to well bear various critical services (e.g., web browsing), while limiting the inordinate occupation of network resources by some non-critical services (e.g., Voice over Internet Protocol (VOIP) and Peer to Peer (P2P)). On this basis, the operator needs to identify the protocol type used in the application layer by the message (or referred to as data stream) born by the network.
The current method for protocol type identification is to identify by polling all possibly matched identification characteristic conditions or algorithms. The manner of polling may be sequentially polling in batches. The specific implementation is generally as follows: protocols of the system are classified into high frequent protocols, ordinary protocols, and infrequent protocols according to the use frequencies of the protocols in the network. When a data stream arrives, the data stream is attempted to be identified with all rules or identification algorithms of the high frequent protocols. In case the identification is failed, all rules or identification algorithms of the ordinary protocols are tried. And if the identification is failed again, all rules or identification algorithms of the infrequent protocols are tried. The current method for protocol type identification may also be pattern matching, and the manner of pattern matching is scanning all the protocols at one time, and searching for a protocol matched with the message. The above two methods both require scanning all the protocols, and thus the efficiency is relatively low.
In order to improve the protocol identification efficiency, a new method for protocol identification is proposed. Internet Protocol (IP) address and port pair of a message are extracted. A preset association table is searched for an entry including the IP address and the port-pair, and the association table stores entries of the correspondence between IP addresses and port-pairs and service types (a service type is corresponding to the used protocol, and once the service type is determined, the protocol used by the message can also be determined). And when the entry including the IP address and port-pair is searched in the preset association table, the service type of the message is that indicated by the entry.
During the process of implementing the present invention, the inventor finds that there are many identification errors when just using the IP address and port-pair to determine the service type of the data stream, because the phenomenon of port multiplexing (i.e., one IP address and port-pair can be used for different types of services) frequently occurs in the current network. Therefore, the method is not suitable to the occasion requiring a high precision of message identification.